Security audit
Security checks across malware telemetry and agentic risk
This is a broad but coherent photo-editing skill; its main privacy risk is that selected images and metadata may be sent to AI or optional R2 services when those features are used.
Install only if you are comfortable with selected photos being processed by external AI services for AI features. If enabling R2 upload, use your own trusted worker URL and scoped token. Strip EXIF metadata before sharing edited images when location, device, or timestamp privacy matters, and avoid using untrusted filenames with command-like prefixes.
req.add_header("User-Agent", "Mozilla/5.0")
try:
with urllib.request.urlopen(req, timeout=120) as resp:
body = resp.read().decode()
result = _json.loads(body)
url = result.get("url", "")venv_rembg = self.venv_python.replace("/bin/python", "/bin/rembg")
for cmd_candidate in ["rembg", venv_rembg]:
try:
subprocess.run([cmd_candidate, "--help"],
capture_output=True, timeout=5)
rembg_cmd = cmd_candidate
breakif rembg_cmd and tool in ("auto", "rembg"):
try:
self._log("Using rembg for background removal...")
result = subprocess.run(
[rembg_cmd, "i", image, output],
capture_output=True, text=True, timeout=60
)bg_hex = '#%02x%02x%02x' % bg_color
# Make detected background color transparent
result = subprocess.run(
[im_cmd, image, "-fuzz", "20%", "-transparent", bg_hex, output],
capture_output=True, text=True, timeout=30
)args.append(output)
result = subprocess.run(
args,
capture_output=True, text=True, timeout=30
)if im_cmd:
try:
result = subprocess.run(
[im_cmd, image, "-crop", f"{width}x{height}+{x}+{y}",
"+repage", output],
capture_output=True, text=True, timeout=30args.append(output)
result = subprocess.run(args, capture_output=True, text=True, timeout=30)
if result.returncode == 0:
elapsed = int((time.time() - start) * 1000)65/65 vendors flagged this skill as clean.
No suspicious patterns detected.